Privacy Policy

Thank you for visiting vibealignment.co, the website of Vibe Alignment Co. We respect and protect your privacy. This policy explains what personal information we collect, why, who helps us handle it, how long we keep it, and the choices and rights you have, wherever you live.

If we change this policy, we'll update the "last updated" date above. If a change matters to how we use information you've already given us, we'll tell you by email before it takes effect.

Who we are

Vibe Alignment Co. is run by Carver Johnson in Canada. Carver is responsible for your personal information (the "controller" or "responsible party" under privacy laws) and is our privacy contact. For anything about your privacy, email info@vibealignment.co.

Confidentiality

vibealignment.co takes client confidentiality very seriously. Any personal information or details discussed during sessions will be kept strictly confidential. We maintain full privacy of client records and session content except where disclosure is required by law.

What we collect

"Personal information" is anything that can identify you. Here's what we collect and when:

• When you book a live session: your name, email address, the time you chose, your time zone (so times can be shown in your own time when we book with you again), and anything you add to the booking.
• When you order or join something: your name, email address, billing country and address, and what you bought (through ThriveCart). Card details go straight to Stripe; we never see or store them.
• When you send us your details for an order or fill in a form: your answers, which can include your questions, what's going on in your life, and, if you choose to add one, a photo.
• When you sign up for our emails: your email address, and whether you confirmed and opened our emails (through Kit).
• When you join The Line and use The Vault: see "The Vault" below.
• Referrals and Gratitude Credit: if you buy from us, we create your referral link with our checkout (ThriveCart) using your name and email. We keep a record of the credit you earn and use (amounts, dates, order numbers, the codes you cash in, and the currency you first paid in, so we can show prices and credit in it). If you arrive through someone's referral link, your browser remembers that for 30 days (no personal details) so your discount and their credit apply.
• Invitations to The Gathering: if you ask for a place through an invite link, your name and email, so we can email you a link to confirm it. Once you confirm, your place is kept like any other booking.
• Prepaid and gifted sessions: your email and the session waiting to be booked, so the booking calendar knows it's paid for.
• When you email us: your email address and whatever you choose to share.
• When you visit the site: our host, Cloudflare, briefly processes your IP address to deliver pages and protect the site. We use the country it comes from to show prices in your likely currency. We don't keep your IP address, apart from this: to stop abuse, such as too many sign-in tries, the site keeps short-lived counts against an IP address or an email address. Most last an hour, some a day, and the card draw's up to 30 days. They hold a number, not what you did, and delete themselves. To see how people find us, the site keeps daily totals as it serves pages: which website sent a visit (for example Google, Instagram or an AI assistant, as your browser tells every site it opens) and which page was opened. A total is just a count, such as "12 visits to The Line from Google today": no IP address, no cookie, nothing that could tell us who you are, and no tracking script on the site. We keep these totals for 400 days. We also read Google Search Console, which shows which Google searches led to the site, as totals with no personal details.

Providing information is voluntary, but we can't take a booking or fulfil an order without the details it needs.

Health and other sensitive details

Some services work best when you tell us what you're going through, and that can include things about your health, emotions, beliefs or relationships. You never have to share these. If you choose to, you're giving us your explicit consent to use them only to prepare and deliver your session or order. You can withdraw that consent by emailing us, and we'll delete what you shared, unless we're legally required to keep it.

Please don't send us government ID numbers, banking details or card numbers.

Why we use it

• To provide what you asked for (bookings, orders, memberships, replying to you). This is needed to carry out our agreement with you.
• To send our newsletter, only if you signed up and confirmed. This is based on your consent, which you can withdraw at any time with the unsubscribe link in every email.
• To send your welcome gift, if you ask for it: we check with Kit that your email is confirmed, email you a one-time code, and keep a scrambled, one-way version of your email (it can't be turned back into your address) so each email gets one gift. The gift is yours to keep, even if you unsubscribe.
• For the card draw, if you draw a card when you join our emails: we keep your email encrypted while your card waits, so we can send you your gift, and a scrambled, one-way version of it (it can't be turned back into your address) so each email gets one draw. If you're already on our list, we email you a link to open your card instead. Cloudflare checks the draw page for bots (Turnstile). Your gift is yours to keep, even if you unsubscribe.
• To email customers about their purchase, such as receipts, access links and changes to a booking. These are part of providing what you bought.
• To keep the site working and secure, and to show prices in your currency. This is our legitimate interest in running the site, and it doesn't override your rights.
• To keep business and tax records, because the law requires it.

We don't sell or rent your personal information, we don't share it for advertising, and we don't make automated decisions about you.

Who helps us

We use a small number of trusted services to run the site. They only get what they need to do their job for us:

• Cloudflare hosts the website, The Vault and its audio, plays The Line's live broadcasts and their recordings (Cloudflare Stream), and looks up your country from your IP address.
• ThriveCart runs checkout, receipts and course access; Stripe processes payments.
• Cal.com is the platform our booking system runs on, and hosts our live video calls (Cal Video). It stores bookings and sends booking emails.
• Kit sends our newsletter.
• Resend sends The Sanctuary's sign-in emails, next-step and reminder emails about your bookings and orders, and replies to questions from people who aren't clients yet.
• Google provides our business email and our calendar, which holds your session bookings.
• Anthropic makes Claude, an AI assistant Carver uses to build and maintain the site. It isn't given your answers, photos, messages or signed releases (see "AI tools" below).
• Frankfurter (European Central Bank exchange rates) is asked for today's rates to convert prices on the page; it receives no personal details beyond the request itself.

Some of these companies store information outside your country, including in the United States. Where the law requires it, they protect it with recognised safeguards such as the European Commission's Standard Contractual Clauses. We may also share information if the law requires it, or if the business changes hands (and then only under this policy).

Cookies and your browser's storage

We don't use advertising or tracking cookies, or analytics tools. The site only stores what it needs to work:

• The card draw: a small note in your browser ("va-draw", no personal details) so coming back shows the same card, and, for that visit only, the email you typed. Cloudflare's bot check (Turnstile) runs on the draw page to keep the draw fair.
• Your choices: your currency and time zone, and a note of which order you're filling in details for, are saved in your own browser so the site remembers them. They never leave your device.
• The Sanctuary: if you sign in, we set one strictly necessary cookie that keeps you signed in on that device, plus a second cookie and a note in your browser, both with no personal details, so the site can show you're signed in. The Vault page also uses your browser's own storage to remember where you left off, your playback speed, and any replays you download to the player for offline listening. Downloaded replays stay inside the player, are removed if you sign out or your membership ends, and you can remove them at any time.
• Booking and checkout: our booking calendar is on this site, and Cal.com handles the scheduling behind it, so nothing from Cal.com loads in your browser. ThriveCart only loads when you click to check out. It may set its own cookies to make that work, under its own privacy policy.

You can see this summary any time from "Cookie settings" at the bottom of every page. You can also clear or block storage in your browser settings, though some features (like staying signed in to The Sanctuary) won't work without it.

Our newsletter emails, sent through Kit, can tell us whether an email was opened and which links were clicked, so we know what's helpful. Most email apps let you block images to turn this off.

The Vault (replays for members of The Line)

Members of The Line can play replays on our website in The Vault. To do this, we keep a small record of members so the site knows who can listen:

• What we store: your email address, whether your membership is active, the dates it was paid until, started and last changed, and which Library recordings you've bought (so we can show them as yours, play them for you and let you download them). We also keep your first name, taken from your order (or from a booking, if you haven't ordered yet), only so My Sanctuary can greet you by name. We don't store your full name, address or any payment details for this. Payments are handled by ThriveCart and Stripe.
• How we get it: ThriveCart, our checkout provider, tells our website when you join, renew, cancel or are refunded. For a few days after a payment, we also keep a copy of the payment notice with your personal details removed, to check that our systems are working.
• Signing in: when you ask to sign in, we email you a one-time sign-in link and code. These emails are sent through Resend, our email delivery provider. Straight after checkout you may be signed in automatically instead.
• Where it's kept: on Cloudflare, which hosts our website, stores the member record and the replay audio, and runs the sign-in.
• How long: your membership record is deleted 12 months after your membership ends, unless you ask us to delete it sooner. Your first name is deleted 13 months after your last order or booking. The list of Library recordings you've bought is kept for as long as they're yours to access, so you keep them with no time limit, and is removed if you ask us to delete it or if a purchase is refunded. Sign-in links expire after 20 minutes. You're signed out after 3 days away from the site, and asked to sign in again at least every 90 days.
• Your listening: we don't track which replays you play. "Resume where you left off", your playback speed and any replays you download to the player are kept only in your own browser, on your own device.

You can ask us to delete your member record, your first name and your list of purchased recordings at any time by emailing info@vibealignment.co. This doesn't affect your purchase records, which ThriveCart keeps.

Your client file

When you book or buy, we keep a file for you so the site can show your next step: your name and email, what you've booked or ordered, the steps you've completed, the times of your appointments, and any release you've signed, with its exact wording and the time you signed. Your name, email and signatures are encrypted with our own key, on top of the encryption our host Cloudflare uses, and stored in the European Union. We keep a log of who viewed or changed your file. The log never holds your answers.

How long we keep it

• Newsletter: until you unsubscribe, then removed from our list.
• The card draw: if you never confirm, your encrypted email is deleted 90 days after you draw. Once your card is unlocked, its record (your card, gift and code) is kept until 30 days after its 90 days end. The one-way scrambled version is kept, so the same email can't draw twice.
• Booking and order details: for as long as we're working with you, then up to two years so we can help with follow-up questions, unless you ask us to delete them sooner.
• Your answers and photo for a remote order: 90 days after your order is delivered, or after it's refunded or cancelled.
• Your delivered order (The Message or a recording): in My Sanctuary until you delete it. A delete button is right there.
• Working copies of your Custom Med: the recording and the files used to make it are kept on our own computer while it's made, and deleted 30 days after your Custom Med is delivered. Your delivered copy stays in My Sanctuary, as above.
• Your messages with Carver: stored encrypted on our site, with your client file, or with your question if you're not a client yet. If you're not a client yet, our reply also reaches you by email, through Resend.
• A record of your bookings, payments and emails we send you: whether an email arrived and whether its link was used, never what you did inside it. We don't track whether you open emails. Kept with your client file.
• Questions and group enquiries: 12 months. The Journey waitlist and the self-guided notify list: 2 years. Reviews: 3 years, or as long as a review you let us share stays on the site. You can ask us to delete any of these sooner.
• An invitation you haven't confirmed: your name and email are deleted after 48 hours, or when the gathering starts if that's sooner.
• Signed releases: 3 years after your last service, in case of a dispute.
• Purchase and tax records: six years, as Canadian tax law requires.
• The Vault: as set out above.
• Referral and credit records: while you have credit or a referral link with us, then 12 months, unless tax law asks us to keep them longer. Prepaid and gift session records: 12 months after the last change.
• Emails to us: until the conversation is done and we no longer need them.
• Backups: encrypted copies of our records, kept for up to 35 days, so something you've had deleted leaves our backups within that time.

Data security

We are committed to protecting the data and personal information you provide to us.

• In transit: everything between your device and this site travels over an encrypted (HTTPS) connection.
• At rest: what the site stores is kept in private storage that our host, Cloudflare, encrypts. On top of that, the most personal parts of your client file (your name, email, answers, notes, messages, signed releases and photos) are individually encrypted with our own key, which isn't kept with the data.
• Access: only the practitioner, Carver Johnson, can open client files, behind a protected sign-in, and each opening of a file is logged.
• Our service providers protect what they hold for us with their own security measures, including encryption.

No system is completely secure, so we also keep to the limits above on how long we hold things.

AI tools. This website and our content are written with the help of AI tools. The website itself never sends what you share with us to an AI service.

Carver also uses an AI assistant (Claude, made by Anthropic) to help build and look after the site. It is set up to work without knowing who you are: it uses counts and hidden names wherever it can. Now and then, while helping with a task, it may come across a limited detail such as a name, an email address or a booking time.

We don't give it your form answers, photos, messages or signed releases; only Carver opens those. It can never see your card or bank details, because we never hold them: payments are taken by ThriveCart and Stripe.

If a breach ever put your information at real risk, we'd tell you and the authorities as the law requires.

Your rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct it if it's wrong;
• delete it (unless we have to keep it by law, such as tax records);
• stop using it, or use it only in limited ways, including for marketing;
• give it to you in a format you can take elsewhere;
• withdraw any consent you've given (this doesn't affect what we did before).

Email info@vibealignment.co. We may need to confirm it's you, and we'll reply within 30 days. There's no charge.

Delete my data in My Sanctuary: once you're signed in with the link from your email, you can delete your own data yourself, under "Anything else" (or the Me sheet on a phone). It deletes straight away what this site keeps about you: your client file, answers, notes, messages, delivered orders, Gratitude Credit, your list of Library recordings, your membership record, your card draw and your sign-ins. If you've signed a release, only that release, with your name and email, is kept for 3 years after your last service, as above. It's left in our encrypted backups for up to 35 days. It doesn't reach ThriveCart (payment records) or Cal.com (past bookings): email us and we'll remove what the law lets us there. Carver gets a short email saying you've done this, so anything left with ThriveCart or Cal.com can be dealt with if you ask. If you have a session coming up or a membership that renews, cancel or stop it first.

European Union and United Kingdom: you also have the right to object to our use of your information based on legitimate interests, and to complain to your local data protection authority (in the UK, the Information Commissioner's Office).

Canada: you can contact the Office of the Privacy Commissioner of Canada if you're not satisfied with our answer.

United States (including California): we don't sell or share personal information for advertising, and we treat requests to know, correct or delete from every US state the same way. We won't treat you differently for using your rights.

Mexico: you can use your rights of access, rectification, cancellation and opposition (ARCO) and withdraw your consent by emailing us, with your name, what you're asking for and a way to confirm it's you.

Children

We don't knowingly collect personal information from anyone under 19. Our services are for people aged 19 and over. If you are under 19, please don't give us any personal information or use our services. If you think a child has given us information, email us and we'll delete it.

Other websites

Our site links to other websites, such as our social media. They have their own privacy policies, and we're not responsible for how they handle your information.

Questions or concerns

If you have any questions or concerns about how we handle personal information, contact us at info@vibealignment.co.

This policy does not provide any medical advice, diagnosis or treatment. Consult a licensed medical professional for any health concerns. Any products or services obtained are for informational purposes only.

Use of this website is also covered by our Client Disclaimer & Terms of Service.